russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.1 KiB

Raw Permalink Blame History

SolveSpace — CWE-407 Disclosure Brief (solvespace-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

An O(T×C) colour dedup scan in VRML mesh export at src/export.cpp:1220. For each triangle in the mesh, std::find_if() scans the colours_present vector to find matching RGBA values, performing O(C) per triangle where C = unique colours seen. With T triangles, total cost reaches O(T×C).

The Defect

solvespace-0002 (PATCHED — MEDIUM): src/export.cpp:1220

std::vector<RgbaColor> colours_present;
for(const auto & tr : sp) {
    const auto colour_itr = std::find_if(colours_present.begin(), colours_present.end(),
        [&](const RgbaColor & c) { return c.Equals(tr.meta.color); });
    // O(C) per triangle

Complexity Proof

At T=50,000 triangles, C=100 unique colours:

Defective: 50,000 × 100/2 = 2,500,000 comparisons
Fixed: 50,000 × O(1) hash lookups = 50,000 probes
50× op reduction

Impact

SolveSpace exports 3D models to VRML format for 3D printing, visualization, and interchange. Complex models with many faces and per-face coloring trigger the worst case during export. Large assemblies produce meshes with tens of thousands of triangles.

The Fix

Replace std::vector<RgbaColor> with std::unordered_map<uint32_t, int> keyed on RgbaColor::ToPackedInt():

std::unordered_map<uint32_t, int> colour_to_index;
uint32_t key = tr.meta.color.ToPackedInt();
auto it = colour_to_index.find(key);
if(it == colour_to_index.end()) {
    colour_to_index[key] = next_colour_index++;

Patch

Fix available: defects/solvespace-0002/patch/solvespace-0002-vrml-export-colour-hashmap.patch

50× op reduction at T=50,000, C=100.

What We Ask

Confirm receipt and assign a GitHub issue reference (solvespace/solvespace).
Assess severity — fires during VRML export of complex models.
Coordinate a disclosure date — targeting 90 days from first contact.
We will credit the SolveSpace team in the public disclosure.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.1 KiB Raw Permalink Blame History Unescape Escape